Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/05/2026, 12:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6881d3138ad95abb6d4ae0e16a1cabfb51b24d4d729c09f8225f1e3f5db2e735.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6881d3138ad95abb6d4ae0e16a1cabfb51b24d4d729c09f8225f1e3f5db2e735.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 6881d3138ad95abb6d4ae0e16a1cabfb51b24d4d729c09f8225f1e3f5db2e735.exe
- Size 1.2MB
- Sample260508-ps72lahs2s
- SHA256 6881d3138ad95abb6d4ae0e16a1cabfb51b24d4d729c09f8225f1e3f5db2e735
- MD5 4a365033323051d90b7a161b4b9a15fc
- SHA1 112292743ddf5f9b1e1e30b493f61b0360e65130
- SHA512 493e297df3142d589ea7f2a2d5023b67a92edd4225e44ae37d03d316208cf810008d5772e4b24b32132cd23692cbba18719c471db6e59e0857f4873abff3338f
- SSDEEP 24576:yuNt0WAsayeoFriCTebXXFeQG3BZ5MjdyYSJJSHwH:yC2EooFGCCbHFeQGRZ5MJpqUwH
- TLSH T13F4501452715DF02C5969BF01E70E3B50BF56D852411D327CEE77DEBBA38B12AA00A93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1104 set thread context of 3728 1104 6881d3138ad95abb6d4ae0e16a1cabfb51b24d4d729c09f8225f1e3f5db2e735.exe 81 - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3728 6881d3138ad95abb6d4ae0e16a1cabfb51b24d4d729c09f8225f1e3f5db2e735.exe 3728 6881d3138ad95abb6d4ae0e16a1cabfb51b24d4d729c09f8225f1e3f5db2e735.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1104 wrote to memory of 3728 1104 6881d3138ad95abb6d4ae0e16a1cabfb51b24d4d729c09f8225f1e3f5db2e735.exe 81 PID 1104 wrote to memory of 3728 1104 6881d3138ad95abb6d4ae0e16a1cabfb51b24d4d729c09f8225f1e3f5db2e735.exe 81 PID 1104 wrote to memory of 3728 1104 6881d3138ad95abb6d4ae0e16a1cabfb51b24d4d729c09f8225f1e3f5db2e735.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\6881d3138ad95abb6d4ae0e16a1cabfb51b24d4d729c09f8225f1e3f5db2e735.exe"C:\Users\Admin\AppData\Local\Temp\6881d3138ad95abb6d4ae0e16a1cabfb51b24d4d729c09f8225f1e3f5db2e735.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\6881d3138ad95abb6d4ae0e16a1cabfb51b24d4d729c09f8225f1e3f5db2e735.exeC:\Users\Admin\AppData\Local\Temp\6881d3138ad95abb6d4ae0e16a1cabfb51b24d4d729c09f8225f1e3f5db2e735.exe2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3728
-